6 ms·

The thinking of "we don't want the system to not work if it's needed" thinking demonstrates a failure to understand the prior probabilities involved. Most of t

by paulmd 7y ago

The thinking of "we don't want the system to not work if it's needed" thinking demonstrates a failure to understand the prior probabilities involved. Most of the time the flight conditions will not warrant activation of the MCAS, and apparently the system is sufficiently unreliable/easy to damage that the chances of the system inadvertently triggering is high. But Boeing wanted to be sure that MCAS would always activate if needed, even if that resulted in unintended activations normally. Boeing essentially optimized around a low probability of a false negative, while ignoring the high probability of a false positive, because they underestimated the consequences and confusion that would result from a false positive - in many cases, multiple alarms/system failures occurring simultaneously as other systems that rely on that sensor begin alarming as well. In that environment, designing around a 3 second response time (on a system that pilots weren't trained to know exists) is probably unreasonable.

usrusr 7y ago
Well, Boeing is multiple people. Business culture celebrates a manager who can push their project ahead of others. Maybe MCAS had a project manager who was a bit of an overachiever in that regard.
- jdc 7y ago
  Surely I'm not the only one reading "overachiever" here as a wry euphemism.
  - usrusr 7y ago
    Not really: person A is tasked with remeditating risk X (dangerous pitch-up at high AoA), persons B, C are tasked with remediating some other risks Y, Z, or just generally keeping an eye on the big picture. Now if person A is better than the others at pushing the needs of their particular target metric (or just more stubborn, a particularly easy form of "strength"), that plane will surely never crash due pitch up at high AoA, but maybe more likely due to other dangers that became more likely for the sake of never crashing from that pitch up problem that A was sent out to solve. This cost will be seen as a consequence of the weakness of B, C, not of the "strength" of A. The high-resolve powerplayer who pushes their assigned task ahead of big-picture concerns is the hero of ambitious middle management culture. We see that happen many times, just rarely in domains as deadly as aviation.
mantap 7y ago
If it were designed correctly, it shouldn't matter if it were activated or not - it would always be safe. If it were designed correctly there would be at least 3 AoA sensors and the loss or disagreement of one would not affect the functioning of the system other than displaying a warning message to the pilots. If the two remaining disagreed then the system would be disabled. This is assuming that the system is necessary for certification or safety, if it is not necessary for certification or safety then it shouldn't be there at all. The fact that Boeing put a secondary autopilot in there with a single point of failure, can only be explained by organisational failures reminiscent of the Challenger disaster.
- salawat 7y ago
  The airframe cannot be certified airworthy without MCAS according to existing regulations. It is quite literally the only thing enabling the airframe to pass basic design requirements that have been mandated for years.
  - xtof 7y ago
    Citation? Nothing in FAR 25 permits a computer system to make airworthy an unairworthy airplane design.
    - salawat 7y ago
      Equivalent safety exception. It's the blanket exception that makes most fly-by-wire controlled aircraft airworthy. The problem here of course, is that you never had enough scrutiny paid to the fly-by-wire implementation to make sure that under no circumstances can the system fail non-operational. This was the subject of much controversy back in the 60's when th 727 was being certified. It required additional workarounds (implementation of a stick pusher) to be certified airworthy in U.K. airspace. That certification went through despite the protest of Test pilots at the time that certifying an airframe with a widget to "plaster over" non-compliant behavior would simply start a slippery slope of normalization of deviance whereby engineers would over time be able to certify less "passively" airworthy frames. Those pilots were absolutely correct; as by definition that is exactly what most fly-by-wire aircraft are. Airframes that are only rendered airworthy with the addition of computer logic. See the Royal Aeronautics Society D.P. Davies Interview. Should be in this one. The 727 section starts at 51:00 Equivalent level of Safety discussion starts at 1:01:00 [1] https://www.aerosociety.com/news/audio-the-d-p-davies-interview-on-the-boeing-747-the-trident-vc10-one-eleven-the-boeing-727/ https://www.aerosociety.com/news/audio-the-d-p-davies-interv... Highly recommend to listening to all four episodes just because. It's informative, and for me was rather illuminative in terms of the constant conflict between aerodynamicists to leverage every trick possible to deliver more efficient designs, and pilots to ensure that planes don't become so complex to fly that they can't be reasonably saved even when things go wrong. While history forces us to accept the validity of the approach (no one reasonably wants to kill Airbus); it is obvious there are ways that poorly implemented/communicated fly-by-wire piloting aids render an aircraft less safe. The MAX has illustrated one of these corner cases. Furthermore, just read the article. They lay it out plain as day. The test pilots knew that the MAX's compliance and certifiability couldn't go forward in it's current configuration without being brought back into compliance with MCAS. Despite that, testing to ensure this lynchpin system would not hit any edge case behavior with catastrophic results wasn't done; despite the fact that any reasonable engineer should have realized it was necessary. Give me a bit to drill through and I'll try to find the exact line this "equivalent safety exception" maps to. I'm not sure I'll find it because from the way Davies talks about it it strikes me as one of those possibly "unwritten" corollaries that tends to live beside anything codified. My main point though, is that this cavalier behavior with regard to airworthyness isn't unprecedented, and has been called out before. I fully accept it was different people working there then, but time and again I find echoes of an organization's risk management culture tends to survive the changing of the guard without active attempts to remedy it.
joshanderson 7y ago
The real fix is to never fly on a 737 MAX
- magduf 7y ago
  The plane needs to be refused certification, forcing Boeing to take them all back and scrap them. They need to go back to the drawing board and design a new jet to take its place. If that forces them into bankruptcy, then this should serve as a good lesson about what happens when your company that makes safety-critical products cuts corners and kills people.
cmurf 7y ago
If there is any decent probability it would fail danger (trigger a nose down as a result of bogus high angle of attack information from a single sensor), that means there is a need for pilots to be aware of both the true unaugmented aerodynamic behavior this (MCAS) system is meant to moderate as well as the function of that augmentation system. Put another way: Just put another (virtual) button in the airplane and don't tell the pilots about it or what it's masking. It's important we must have this feature to certify, but it's also really important no one knows about it! If what you're doing is so right, why lie about it? This is a lie of omission, at the very least.

by paulmd 7y ago

usrusr 7y ago

Well, Boeing is multiple people. Business culture celebrates a manager who can push their project ahead of others. Maybe MCAS had a project manager who was a bit of an overachiever in that regard.

jdc 7y ago
Surely I'm not the only one reading "overachiever" here as a wry euphemism.
- usrusr 7y ago
  Not really: person A is tasked with remeditating risk X (dangerous pitch-up at high AoA), persons B, C are tasked with remediating some other risks Y, Z, or just generally keeping an eye on the big picture. Now if person A is better than the others at pushing the needs of their particular target metric (or just more stubborn, a particularly easy form of "strength"), that plane will surely never crash due pitch up at high AoA, but maybe more likely due to other dangers that became more likely for the sake of never crashing from that pitch up problem that A was sent out to solve. This cost will be seen as a consequence of the weakness of B, C, not of the "strength" of A. The high-resolve powerplayer who pushes their assigned task ahead of big-picture concerns is the hero of ambitious middle management culture. We see that happen many times, just rarely in domains as deadly as aviation.

mantap 7y ago

If it were designed correctly, it shouldn't matter if it were activated or not - it would always be safe. If it were designed correctly there would be at least 3 AoA sensors and the loss or disagreement of one would not affect the functioning of the system other than displaying a warning message to the pilots. If the two remaining disagreed then the system would be disabled. This is assuming that the system is necessary for certification or safety, if it is not necessary for certification or safety then it shouldn't be there at all. The fact that Boeing put a secondary autopilot in there with a single point of failure, can only be explained by organisational failures reminiscent of the Challenger disaster.

salawat 7y ago
The airframe cannot be certified airworthy without MCAS according to existing regulations. It is quite literally the only thing enabling the airframe to pass basic design requirements that have been mandated for years.
- xtof 7y ago
  Citation? Nothing in FAR 25 permits a computer system to make airworthy an unairworthy airplane design.
  - salawat 7y ago
    Equivalent safety exception. It's the blanket exception that makes most fly-by-wire controlled aircraft airworthy. The problem here of course, is that you never had enough scrutiny paid to the fly-by-wire implementation to make sure that under no circumstances can the system fail non-operational. This was the subject of much controversy back in the 60's when th 727 was being certified. It required additional workarounds (implementation of a stick pusher) to be certified airworthy in U.K. airspace. That certification went through despite the protest of Test pilots at the time that certifying an airframe with a widget to "plaster over" non-compliant behavior would simply start a slippery slope of normalization of deviance whereby engineers would over time be able to certify less "passively" airworthy frames. Those pilots were absolutely correct; as by definition that is exactly what most fly-by-wire aircraft are. Airframes that are only rendered airworthy with the addition of computer logic. See the Royal Aeronautics Society D.P. Davies Interview. Should be in this one. The 727 section starts at 51:00 Equivalent level of Safety discussion starts at 1:01:00 [1] https://www.aerosociety.com/news/audio-the-d-p-davies-interview-on-the-boeing-747-the-trident-vc10-one-eleven-the-boeing-727/ https://www.aerosociety.com/news/audio-the-d-p-davies-interv... Highly recommend to listening to all four episodes just because. It's informative, and for me was rather illuminative in terms of the constant conflict between aerodynamicists to leverage every trick possible to deliver more efficient designs, and pilots to ensure that planes don't become so complex to fly that they can't be reasonably saved even when things go wrong. While history forces us to accept the validity of the approach (no one reasonably wants to kill Airbus); it is obvious there are ways that poorly implemented/communicated fly-by-wire piloting aids render an aircraft less safe. The MAX has illustrated one of these corner cases. Furthermore, just read the article. They lay it out plain as day. The test pilots knew that the MAX's compliance and certifiability couldn't go forward in it's current configuration without being brought back into compliance with MCAS. Despite that, testing to ensure this lynchpin system would not hit any edge case behavior with catastrophic results wasn't done; despite the fact that any reasonable engineer should have realized it was necessary. Give me a bit to drill through and I'll try to find the exact line this "equivalent safety exception" maps to. I'm not sure I'll find it because from the way Davies talks about it it strikes me as one of those possibly "unwritten" corollaries that tends to live beside anything codified. My main point though, is that this cavalier behavior with regard to airworthyness isn't unprecedented, and has been called out before. I fully accept it was different people working there then, but time and again I find echoes of an organization's risk management culture tends to survive the changing of the guard without active attempts to remedy it.

joshanderson 7y ago

The real fix is to never fly on a 737 MAX

magduf 7y ago
The plane needs to be refused certification, forcing Boeing to take them all back and scrap them. They need to go back to the drawing board and design a new jet to take its place. If that forces them into bankruptcy, then this should serve as a good lesson about what happens when your company that makes safety-critical products cuts corners and kills people.

cmurf 7y ago

If there is any decent probability it would fail danger (trigger a nose down as a result of bogus high angle of attack information from a single sensor), that means there is a need for pilots to be aware of both the true unaugmented aerodynamic behavior this (MCAS) system is meant to moderate as well as the function of that augmentation system. Put another way: Just put another (virtual) button in the airplane and don't tell the pilots about it or what it's masking. It's important we must have this feature to certify, but it's also really important no one knows about it! If what you're doing is so right, why lie about it? This is a lie of omission, at the very least.